HIPAA and your marketing website

Updated 2026-10-16 · 6 minute read

First question: are you a covered entity?

HIPAA applies to covered entities and their business associates. A health care provider is covered if it transmits health information electronically in connection with standard transactions such as claims, as the HHS Office for Civil Rights notes in its bulletin on online tracking technologies. A nursing home, home health agency or hospice that submits Medicare or Medicaid claims electronically meets that test.

Assisted living is less clear. A community that is private pay only and never bills insurance may fall outside HIPAA, while one that bills Medicaid waiver services electronically likely does not. Ask your compliance officer or counsel. Even if HIPAA does not apply, state privacy laws and the FTC Act may, so the practices in this guide are still the safe default.

Everything below is a summary of what the rules and HHS guidance say. It is not legal advice. Confirm how it applies to your organization with your compliance officer or counsel.

What HIPAA does not care about

Your home page, your care type pages, your photos of empty rooms, your job listings and your visiting hours are not protected health information. HHS says that tracking on many unauthenticated pages, such as pages with general information like location, visiting hours, employment opportunities or policies, does not involve PHI and is not regulated by the HIPAA Rules.

Staff bios, leadership photos and a blog about choosing a nursing home are ordinary marketing. You can write them freely.

Contact forms and tour requests

Forms are where a marketing site starts collecting health information. A daughter fills out your tour request and types: Mom has Parkinson's and is being discharged from St. Mary's on Friday. That message identifies a person and relates to her health care.

HHS's position in the tracking bulletin is that individually identifiable health information collected on a regulated entity's website is generally PHI, even if the person does not yet have a relationship with you. The bulletin uses appointment requests and the reason someone is seeking care as examples of information that can be PHI on an unauthenticated page.

• Keep tour and contact forms short: name, phone, email, best time to call, and which care type they are asking about
• Do not add a free-text field asking for diagnosis, medications or medical history. Get that on the phone or at the tour
• Send form submissions to a system covered by a business associate agreement, not a personal inbox or a form tool that will not sign one
• Use HTTPS on every page and do not put form contents in email subject lines or URLs
• Keep tracking pixels off form pages and thank-you pages unless the vendor has signed a BAA and your counsel has signed off

Tracking pixels, analytics and the 2024 court ruling

The OCR bulletin says tracking code on user-authenticated pages, such as a patient portal, generally has access to PHI, and that a tracking vendor that receives PHI on your behalf is a business associate that needs a BAA. It says a cookie banner asking users to accept or reject tracking is not a valid HIPAA authorization. It also says it is not enough for a vendor to promise to strip out PHI after it receives it.

On June 20, 2024, a federal court in Texas ruled in American Hospital Association v. Becerra and vacated part of that guidance. The notice now posted at the top of the HHS bulletin says the court vacated it to the extent it says HIPAA obligations are triggered when tracking technology connects a person's IP address with a visit to an unauthenticated public webpage about specific health conditions or health care providers. The notice says HHS is evaluating its next steps. As of October 2026, that notice is still what HHS shows on the page.

What that means in plain terms: an IP address plus a visit to your public memory care page is no longer, by itself, treated as a HIPAA disclosure under the guidance. The rest of the bulletin still stands. Forms, scheduling tools, portal login pages and anything where a person types or selects health information are still in scope, and the rule itself has not changed. Impermissible disclosures of PHI to vendors are still violations.

• Inventory every script on your site: analytics, ad pixels, heat maps, chat widgets, session replay
• Remove session replay and ad pixels from any page with a form, a portal login or a scheduling tool
• For conversion tracking, count a form submission without sending what was typed in it
• Ask each vendor whether it will sign a BAA. If not, keep it away from pages that collect health information
• Add tracking technologies to your HIPAA Security Rule risk analysis, which OCR says is its enforcement priority in this area

Testimonials and photos of residents

A photo of a resident on your website, captioned as a resident of your community, tells the world that person receives care from you. Full-face photographs are one of the identifiers listed in HIPAA's de-identification standard at 45 CFR 164.514(b).

Using PHI to promote your services is marketing under HIPAA. The definition in 45 CFR 164.501 covers a communication that encourages people to purchase or use a product or service, with narrow exceptions. Under 45 CFR 164.508(a)(3), you need a written authorization for marketing uses, with exceptions only for face-to-face communications and promotional gifts of nominal value.

A valid authorization has required parts. Section 164.508(c) lists them: a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and a signature and date. If a personal representative signs for a resident who cannot, the form must describe that person's authority. It must also tell the person they can revoke it in writing, whether care depends on signing, and that information shared may be redisclosed. It must be in plain language, and you must give the signer a copy.

• Use a marketing-specific authorization that names the website, social media and print, and how long you will use the photo or quote
• Get it signed by the resident, or by their legal representative if the resident lacks capacity
• Keep a log of who signed, when, and when each authorization expires
• Take a photo or testimonial down promptly when someone revokes
• Family members speaking about their own experience still identify the resident, so treat their testimonials the same way

Replying to online reviews

This one costs providers real money. In June 2023, OCR announced a $30,000 settlement with a New Jersey psychiatric practice that had disclosed patients' information while replying to negative Google reviews, including one patient's diagnosis and treatment, according to a Workplace Privacy Report summary of the settlement. The OCR director's message was blunt: disclosing PHI in reply to a review is not allowed.

Even confirming that a reviewer was a resident can be a disclosure. Google's own advice on replying to reviews says never to share a reviewer's private information and to ask the reviewer to contact you privately about complex issues. Write a short reply that thanks them, says you take concerns seriously, and gives a name and phone number to call. Nothing about care, dates or conditions.

Posting your Notice of Privacy Practices

This is the one HIPAA item your website is required to carry. Under 45 CFR 164.520(c)(3)(i), a covered entity that maintains a website providing information about its customer services or benefits must prominently post its notice on the website and make it available electronically through the site.

The same section requires a provider with a direct treatment relationship to post the notice in a clear and prominent location at its physical site, have copies available to take, make a good faith effort to get a written acknowledgment of receipt, and make a revised notice available on or after its effective date. The notice also has required content, including a specific header in capital letters.

Link to the notice in your footer on every page, as a web page or an accessible PDF. Check that the version online matches the version in your lobby. The current rule text includes language about substance use disorder records under 42 CFR part 2, so if your notice was last revised several years ago, ask your compliance officer to compare it with the current rule.

Checklist

• Confirm with counsel whether your organization is a HIPAA covered entity
• Post your Notice of Privacy Practices in the site footer on every page
• Trim tour and contact forms to contact details and care type only
• Route form submissions to a system covered by a business associate agreement
• Inventory all tracking scripts and remove ad pixels and session replay from form and portal pages
• Use a written HIPAA marketing authorization for every resident photo and testimonial
• Keep an authorization log with expiration dates
• Train whoever answers reviews to reply without confirming anyone was a resident
• Add website tracking to your annual Security Rule risk analysis

Questions

Sources

1. HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
2. eCFR: 45 CFR 164.520 Notice of privacy practices
3. 45 CFR 164.508 Uses and disclosures for which an authorization is required (LII)
4. 45 CFR 164.501 Definitions (LII)
5. 45 CFR 164.514 De-identification (LII)
6. Workplace Privacy Report: OCR settlement over replies to online reviews (June 2023)
7. Google Business Profile Help: Tips to get more reviews

This guide is general information, not legal advice. Confirm regulatory and legal questions with your compliance officer or counsel.